Skip to main content
Databricks is a data and AI platform used for analytics, machine learning, and data engineering. Connect your Databricks account to Oleria to bring users, groups, Unity Catalog resources and grants, workspace-object permissions, secret-scope access, credentials, and job-run activity into your identity and access graph, across every workspace in the account.

​
What Oleria discovers

  • User accounts and profile attributes, synced at the account level.
  • Groups and their memberships.
  • Unity Catalog resources and grants, workspace-object permissions, secret-scope access, and credentials.
  • Job-run activity across every workspace in the account.
Oleria uses this data for dormant account detection and access reviews, synced across every workspace in the account on Oleria’s regular sync schedule, not just the workspace you connect from.

​
Prerequisites

  • Access to the Databricks account console with permission to create a service principal and grant account-level roles.
  • The account ID for your Databricks account.
  • Admin access on the Oleria platform to add a new integration.

​
Create a service principal in Databricks

1

Create a service principal and OAuth secret

In the Databricks account console, create a service principal and generate an OAuth client secret for it. Save the Client ID and Client Secret - you’ll need both in Oleria.
Databricks shows the client secret only once, when you generate it. Regenerate it from the service principal’s page if you lose it.
2

Grant account_admin at the account level

Grant the service principal account_admin at the account level. Workspace-level admin access alone isn’t sufficient for account-wide SCIM and Unity Catalog metastore APIs.
3

Assign workspace-level access to each workspace

Assign the service principal workspace-level access to every workspace you want Oleria to read. Granting account_admin doesn’t do this automatically - add the service principal to each workspace separately.

​
Connect Databricks to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations, then select the Databricks tile.
2

Complete the connection form

Select Continue and fill in the connection form:
3

Save the integration

Select Connect to validate the credentials and save the integration.

​
Verify the integration

Confirm the new instance appears on the Connected tab of your Oleria Integrations page with a status of Healthy. Oleria syncs users, groups, Unity Catalog access, and job-run activity from every workspace in the account on its regular sync schedule once the initial sync completes.
If a workspace is missing from Oleria’s results, confirm the service principal has been explicitly added to that workspace. Account-level account_admin alone doesn’t grant workspace-level access.

​
Remediation actions

Oleria can also invoke lifecycle actions in Databricks using the same service principal:
  • Enable or disable a user account
  • Add or remove a user from a group
Databricks doesn’t offer a read-only account-level role, so discovery and remediation actions both use the service principal’s account_admin role. Oleria only makes changes in Databricks when you run a remediation action.

​
Contact us

For questions about this integration, contact us at support@oleria.com.